[Identifying deleted items]

Thanks Lukas.

[Identifying deleted items]

Hello Lukas

 

Thanks for your reply. Just a follow up question. After loading relevant files including emails and PSTs in Intella, for deleted email, does it get recovered BACK into the inbox or does it gets recovered to "deleted items". I would understand it being recovered to "deleted items" if it was already there I.e a soft-delete, but a hard-delete (shift-delete) on a email in the inbox... Where does Intella recover that to?

 

Cheers!

[Identifying deleted items]

Is it possible to identify the deleted items and the date of deletion if the data sets are extracted from EnCase (not from DD images).

 

[Exporting attachments in emails for particular extension names]

Thank you for your reply. I think this will help a lot. Perhaps you can also show me the way to extract embedded URLs from emails to a CSV format and in this way it would be much easier to identify unusual URLs.

 

Thanks again.

[Exporting attachments in emails for particular extension names]

Hello. Just registered in this community. May I ask someone who can give an advise on how to export email attachments with specific file extensions. We are looking for possible phishing attempts from external emails that may have attachments which could be malicious. Thank you.